IT Network Admin - Need some expert advice

[Shuey]

Hello everyone

I am a network admin and computer instructor at a local school and I was looking for a solution that would enable me to remotely control student and staff machines for help desk related purposes. I did a little research and narrowed my choices down to TightVNC or UltraVNC. Ultra seemed the better choice in my opinion so I downloaded it and tried it out (I am using UltraVNC-100-RC203-Setup.exe). I was thrilled with how simple it was to install and use. I tried it with a few staff and now I want to move on to setting it up on the student machines. This is where my challenge lies...

Some miscellaneous info that may or may not have anything to do with what I'm trying to accomplish: I have a computer lab that has 12 Windows XP Professional machines running Deep Freeze (Deep Freeze should have no effect on what I want to accomplish because it will be thawed when I install and configure the software and it should run fine once I refreeze the machines). The machines are not connected to our domain (yborg), instead they are all using the workgroup feature with the name "yborg" (same as our domain name) and I have a universal login for the students at the server level. So when they login to their machines, they are essentially using passthrough authentication. I won't go into why I set it up this way, but I just wanted to give that info in case it may have bearing on how I go about installing and setting up the UltraVNC software on each machine.

What I'm trying to accomplish:
1. I would like to have it where the UltraVNC software starts up as soon as the student logs in to Windows
2. I would like the software to be running without them really seeing it or knowing it running. It would also be very nice to keep them from being able to kill it from the task manager. If this part of the configuration will be partly a permissions issue, I need to have a way for the software to atleast run while at the same time not allowing them to disable or configure the software in any way.
3. I would like to be able to remotely connect to their machines and disable control of their mouse and keyboard from their local machine so I have full control of the mouse and keyboard from my remote connection (It looks like this is a simple matter of just disabling local inputs in the server configuration)

Another question I have is about the three options in the server configuration portion: disable tray icon, disable clients options in tray icon menu, forbid the user to closedown WinVNC - these are all options that I WILL use to restrict what the students are able to do once the software is installed and running right?

Thank you to any and all who help me make sure I'm going about this the right way, it's very much appreciated

[bevtech]

What I'm trying to accomplish:
1. I would like to have it where the UltraVNC software starts up as soon as the student logs in to Windows

Provided the workstations are win2k or xp you can install Ultra VNC as a service..

2. I would like the software to be running without them really seeing it or knowing it running. It would also be very nice to keep them from being able to kill it from the task manager. If this part of the configuration will be partly a permissions issue, I need to have a way for the software to atleast run while at the same time not allowing them to disable or configure the software in any way.

That can be done by the admin properties settings.. You can hide the tray icon disable kill of service.. etc

3. I would like to be able to remotely connect to their machines and disable control of their mouse and keyboard from their local machine so I have full control of the mouse and keyboard from my remote connection (It looks like this is a simple matter of just disabling local inputs in the server configuration)

Correct..

Another question I have is about the three options in the server configuration portion: disable tray icon, disable clients options in tray icon menu, forbid the user to closedown WinVNC - these are all options that I WILL use to restrict what the students are able to do once the software is installed and running right?

Correct once you have it working they way you want it to then lock it down with those settings

[Shuey]

Thank you so much for the reply bevtech! I'll try it out this week when I have time and reply to let you know how it turns out

Thank you again!

[Shuey]

Hey bevtech! Thank you for the information!

It took me a little playing around with the software when I was setting it up as far as the proper sequence to make it all work, but it's working flawlessly now!

Just in case anyone else in a similar situation is looking for help on how to do this as well, I'd like to post how I did it:

(This may or may not be the best approach, but it seemed to be the best way for me after a couple trial and error runs with it)
1- Logged in as an administrator on the local machine
2- Installed the software and chose to install as a service also (but I did not check the box "start service" because I wanted to do that after I allowed the software in XP's firewall)
3- Ran the server and unblocked in XP's firewall
4- Set a password and checked "accept" under "query..." - left the other options at default
5- Connected to the machine from one of the other workstations sitting right next to it
6- Closed the remote connection after it worked, closed vnc from the system tray, and reinstalled the winvnc as a service silent
7- Accessed Windows services - vnc was set to automatic but not started - I started the service and then logged off the administrator
8- Logged in to student account and ran the server - was able to connect to the machine again, closed the remote connection after it worked but left the vnc running in the tray this time, and then logged off the student
9- Logged back on as Administrator and configured the server admin properties from the tray icon - set to: disable local inputs, and checked the boxes that disable control for the user when the server is running (which is all the time)
10- Restarted the machine and logged on as student to test it out - Everything is working great! Students don't know the software is running, can't see it running, and can't control their machines when I'm connected to them - and if they did know the software was running or how to see it, they still can't stop it or change it in any way

Thanks again for the advice bevtech

[Shuey]

Uh oh!! I have a problem with the login on the viewer! I setup the password to be used to connect to the machine, but there's a weird issue with it O_o... My password is tttttttt### where t = an alpha character and # = a numerical character. I entered the full password and could connect no problem. Then just out of curiosity I tried it without the numerical portion and it still worked. I then tried it with a different set of alpha characters and it denied me access...so it seems there's a problem with the software recognizing the numerals?

Hey bevtech, if you end up reading this reply and want more info on this, I'd be happy to email or PM you more info to help me figure this out. This might be a serious coding flaw in the software that the developers need to know about

[bevtech]

only eight charectors will be recognized in the classical authenication.. If more then eight are entered it will ignore the 9,10--etc. So you should be fine.. The max length is only 8..

[Shuey]

Phew! *breathes a sigh of relief*

Thanks for the save bevtech

[r_balest]

guys...
wanna ask some questions here
why's the password always reset to the default?
is something wrong with my configuration?

Help.. Please...

[bevtech]

Well you need to have admin rights to setup and install uvnc then you can try to use normal user rights but you my have issues with that

[typhoon.jaa]

Hi All

I was just wondering if UltraVNC offers an administrator option, allowing an admin to apply patches and work on the clients PC without disturbing their work.

Thank you

[bevtech]

typhoon,

UVNC only uses console 0 so it is not like microsoft remote desktop that uses cosole 1,2, etc..

so that is no..

[typhoon.jaa]

bevtech

Thank you for the quick response, that's fine, i'll find a way around it.

Much appreciated.

Kind reguads - James

typhoon.jaa

[typhoon.jaa]

Hello bevtech,

Is it it possible to login to a PC over the internet (WAN), if so then, how would i go about connecting to the PC, can if enter the Public IP that would attempt to login to router, does the UltraVNC allow to log int the PCs MAC address or is there some other way you can go about this,

Thank you for your time

Kind reguads - James

typhoon.jaa

[bevtech]

yes you need to setup port forwarding please read the FAQ for directions on that..

[yojo056]

well, in my question is, what if you have multiple computers you want to access on the same network over the wan. I am trying to set up a way to tech support a customers computers from a distance and was thinking about how to use port forwarding... but is there a way to change what port all of them are listening on or what?

[YY]

Just A Suggestion, Not An Expert At All

Say: If you need to support a customer via internet having a lot of computers inside his LAN behind a router.

scernerio 1, You need to initial a connection to one of the above computers.
1. Install Winvnc (the server) on every computers.
2. Install repeater on one computer.
3. At router (your customer's), forward port 5901 to the pc running the repeater.
4. Then whenever you want to access any of the computers inside that LAN, you are able to do so via the repeater. Also, any new pc added to the LAN later can be accessed w/o further config.


scernerio 2, a user sitting before one of the above-said computer and want to get your support. He will initial connection to you by using SC, or PcHelpWare, or Reverse connection of WinVNC.
1. He just run the custom SC, or PHW Server you created for that customer. It is not necessary to config port forwarding at his end.
2. At your end, the viewer program is running & waiting for the connection.
3. If your pc is behind a router, you need the port forwarding properly config.


Finally, in both scernerio, the firewall at all computers must be properly setted to allow the necessary traffic.

[yojo056]

how would repeater allow this to work like that?

[YY]

how would repeater allow this to work like that?

This is one of the usage of repeater, called mode 1 operation.
You can see a description at UltraVNC site: http://www.uvnc.com/addons/repeater.html

[yojo056]

I guess I am still not totaly understanding how the repeater works...

[YY]

In short, the viewer connects to a repeater, & then the repeater forward the connection to the destination vncserver.
i.e.

Vnc-viewer --->{INTERNET}----->(5901)Repeater -----> (5900)VNC-server1
　　　　　　　　　　　　　　　　　　　　　　-----> (5900)VNC-server2
　　　　　　　　　　　　　　　　　　　　　　-----> (5900)VNC-server3
　　　　　　　　　　　　　　　　　　　　　　.......................
　　　　　　　　　　　　　　　　　　　　　　-----> (5900)VNC-server-n

When the repeater is config to carry this operation, it is called "Mode I".

There are online documnets of repeater, available here:
http://www.bevingtontechnologies.com/ww ... bystep.doc
http://www.bevingtontechnologies.com/ww ... bystep.pdf

[yojo056]

oh, ok, thanks. I was looking over the page about it, and thats what I figured , it just seemed like there wasn't a whole lot of information right there about it. thank you very much.

[yojo056]

so, when i log into the computer with the repeater... how will i then transfer to another computer on the local lan?? (the docs I have read aren't really that revealing on the subject)

[YY]

You don't need to log into the computer that have repeater running, you just need to use the vncviewer to make the connection with the setting of using "Proxy/Repeater". Rather than direct connect to the vnc server, the viewer will connect to the repeater, and repeater will forward the connection to final destination

Assume you have 50 computers (uvnc installed) inside a LAN, with IP:
192.168.1.1 -- 192.168.1.50

You have a repeater running on a pc 192.168.1.100 at the same LAN, with default settings of "List port Viewer = 5901" & "Enable Mode I"

At the router, you have the setting of 5901 forward to 192.168.1.100

So when you are at somewhere, and want to connect pc 192.168.1.1 via internet, start the viewer like this:

It is true the manual not well expressing the design concept of the operation of the repeater, but the actual operation is really simple. Hope the above can help.
Note: The Customer_Router_IP can be a host name if have one. (e.g. yy.com:5901)

P.S. If you want to access the Repeater PC, you can have it installed with VNC server too. No conflict at all.

[yojo056]

OOOHHH!!! I get it! So the repeater takes in the connection first and forwards it to the appropriate uvnc server! GOT IT! Man is that helpful I don't care what anybody says about you, your alright in my book. Thats so cool. Ok, excellent, thank you very much. I think that answered all my questions.

[ehowe]

Hi All

I was just wondering if UltraVNC offers an administrator option, allowing an admin to apply patches and work on the clients PC without disturbing their work.

Thank you

Bevtech answered 'no' to this, but is there a way to configure a universal password in an install package?

Thanks!

[jobrill]

I'll ask a probably silly question.
I tested Teamviewer 4 (probably built on VNC), and there is so much less config to be done on that.
In Teamviewer I managed to get my viewer to see the server's windows login screen, typed in the pass and all and managed to log in.
I just seem to be doing something wrong in UVNC. I can never get to do that here. If you at times need to do remote tasks which require system reboot (eg. updates) I cannot get to the windows login screen.
I set uvnc to run as service, and all but it is not working.
I'd better asks here and maybe I get an answer. Is windows login view possible in UVNC? If possible, could you please let me know what the settings are? Many Thanks.
==================
ignore this ... it turns out i didn't configure things properly.

[redge]

I tested Teamviewer 4 (probably built on VNC),

Not at all
only TeamViewer until release V2 was VNC compatible.

[algernon24]

I have now a slight better understanding with the repeater and port forwarding scenario on the remote lan. After reading the online documents on repeater provided in this forum, I tried to install it on a pc running as uvnc server but I can't find it in the system tray nor in the services. I'm trying to change port settings.